Need more details regarding "Compare Your Score" section

[Shivani_ra]

Hello Team,

I have recently started analyzing secure score. I read in one of MS link that under "Compare your score" section, we can compare our score to the average score of all the O365 tenants.

What kind of comparison does it talk about here? It shows the average score which would be same for all the tenants with same industry size/seat size. It is showing the average of all under seat size/industry type categories. 

How should we interpret these graphical representation because we do not know the position of my tenant with respect to these averages.

I would really appreciate your feedback on this!! Thanks in advance!!

Thanks,

Shivani

[#2]

Hi,

You shouldn't compare your score to these averages as they are misleading. They also contain trial tenants that are not used anymore. If you set up some as easy as MFA you will already outrank them in a major way. To add to that you need to define your security policies based on your organization's needs, to identify first the business logic for security and match them to the secure score policy. Use it as a guideline, not a scoring mechanism. Some security measures aren't even scored by secure score yet. 

just my two cents

[#3 · Accepted solution]

Hi Shivani,

100% Agree with Jethro here in terms of the score and what it represents. There is an element of gamification in the Secure Score which I often find makes organisations think that if they outscore the industry average by 20-30 points then it means they are ok. It reality it only hides the fact that many Office 365 tenants do not utilise the security controls or best practices within their environments and your organisation becomes only marginally less insecure than the others.

As Jethro said, a lot has to do with mapping your own security requirements and I would add this includes actively managing these on an ongoing basis not just lighting up things like MFA and thinking that will do. Part of that is using secure score over time. There is a great article here about managing security with secure score over time - the first 30 days, then 90, then beyond

https://docs.microsoft.com/en-us/office365/securitycompliance/security-roadmap

And Microsoft have just released a series on best practice here on the TC

https://techcommunity.microsoft.com/t5/Security-Privacy-Compliance/How-to-help-maintain-security-com...

This should be used in conjunction with other tools and guides such as Intune, Cloud App Security and Advanced Threat Intelligence. For things outside Microsoft, if you are a UK based organisation then I would consider Cyber Essentials here

https://www.gov.uk/government/publications/cyber-essentials-scheme-overview

And looking into ISO27001

https://www.iso.org/isoiec-27001-information-security.html

Security improvement is also a lot about training as much as the tools so I would consider how to improve staff behaviours. If you do Cyber Essentials and ISO then there are trading elements. Having a few staff ITIL trained will help too.

Hope that helps.

Best, Chris

[#4]

Thank you Jethro and Christopher for sharing your feedback.

So, this "Compare your score" will not help much. This is indeed confusing.

I understand that we need to be more focus on the actions suggested as part of secure score and make sure other security features are being used.

[#5]

Thanks Shivani,

I think Microsoft intended the secure score compare to help spur organisations on to improve their score, however in the real world this is probably proving to be counterproductive. I wouldn’t be surprised if the compare is removed down the road.

My advice is to use secure score as part of your tool kit for security along with other things such as Cyber Essentials and ISO. Use the recommendations to apply and raise your score to as high as possible where it aligns to your needs and not be too restrictive to users.

I hope we have answered your initial question! If we have, please like the posts and mark on of them as the solution. Look forward to helping you again in the future!

Best, Chris